SaFi Bank Space : KMS encryption for GCP resources

data "google_project" "vm_example_project" {
  provider = google
}

## KMS
## -----------------------------------------------
## Create a KMS key ring to store the key
resource "google_kms_key_ring" "vm_example_key_ring" {
  provider = google
  ## Should match VM's location
  location = var.location_zone
  name     = "vm-key-ring"
}
## Create a crypto key in the generated above key ring
resource "google_kms_crypto_key" "vm_example_crypto_key" {
  provider = google
  name            = "vm-crypto-key"
  key_ring        = google_kms_key_ring.vm_example_key_ring.id
  rotation_period = "100000s"
  lifecycle {
    prevent_destroy = true
  }
}
## Giving permissions to Service account to use the key
resource "google_kms_crypto_key_iam_binding" "crypto_key_iam_binding" {
  provider = google
  crypto_key_id = google_kms_crypto_key.vm_example_crypto_key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  members = [
    format("serviceAccount:service-%s@compute-system.iam.gserviceaccount.com", data.google_project.vm_example_project.number),
  ]
}
## -----------------------------------------------

resource "google_compute_instance" "vm_example" {
  provider     = google
  name         = "vm-example"
  machine_type = "e2-small"
  zone         = var.location_zone
  tags = ["vm-example"]
  boot_disk {
    initialize_params {
      image = "cos-cloud/cos-stable-89-16108-403-26"
    }

    ## Enables encryption data on VM disks
    ## `self_link` is removed: https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/version_4_upgrade#self_link-is-now-removed
    ## => use `id` 
    kms_key_self_link = google_kms_crypto_key.vm_example_crypto_key.id
  }

  <...>
}

data "google_storage_project_service_account" "bucket_account" {
  provider = google
}

## KMS
## -----------------------------------------------
## KMS key ring
resource "google_kms_key_ring" "bucket_key_ring" {
  provider = google
  name     = "bucket-key-ring"
  ## Should match bucket's location
  location = var.region
}
## Key in the key ring for a bucket
resource "google_kms_crypto_key" "bucket_crypto_key" {
  provider        = google
  name            = "bucket-crypto-key"
  key_ring        = google_kms_key_ring.bucket_key_ring.id
  rotation_period = "100000s"
  lifecycle {
    prevent_destroy = true
  }
}
## Allow google_storage_project_service_account access to the crypto key for bucket encryption
resource "google_kms_crypto_key_iam_binding" "bucket_key_iam_binding" {
  provider      = google
  crypto_key_id = google_kms_crypto_key.bucket_crypto_key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  members       = [
     "serviceAccount:${data.google_storage_project_service_account.bucket_account.email_address}",
  ]
}
## -----------------------------------------------

resource "google_storage_bucket" "storage_bucket" {
  provider = google
  name     = "storage-bucket-example"
  ## Check supported locations: https://cloud.google.com/storage/docs/locations
  location = var.google_region
  project  = var.google_project_id
  versioning {
    enabled = true
  }
  encryption {
    default_kms_key_name = google_kms_crypto_key.bucket_crypto_key.id
  }
  depends_on = [
    google_kms_crypto_key.bucket_crypto_key,
    google_kms_crypto_key_iam_binding.bucket_key_iam_binding
  ]
}

data "google_project" "sm_example_project" {}

## KMS:
## for secret-manager - https://cloud.google.com/secret-manager/docs/cmek#automatic-replication
## -----------------------------------------
## Create a KMS key ring to store the key
resource "google_kms_key_ring" "secretmanager_example_key_ring" {
  provider = google
  # The provided key must be in the same region as the secret.
  location = var.google_region
  name     = "secretmanager-example-key-ring"
}
## Create a crypto key in the generated above key ring
resource "google_kms_crypto_key" "secretmanager_example_crypto_key" {
  provider = google
  name            = "secretmanager_example-crypto-key"
  key_ring        = google_kms_key_ring.secretmanager_example_key_ring.id
  rotation_period = "100000s"
  lifecycle {
    prevent_destroy = true
  }
}
## Custom SA for secretmanager api:
resource "google_project_service_identity" "secretmanager_example_service_account" {
  provider  = google-beta
  project   = data.google_project.secretmanager_example_project.name
  service   = "secretmanager.googleapis.com"
}
## Giving permissions to `secretmanager_example_service_account` to use crypto key
resource "google_kms_crypto_key_iam_binding" "secretmanager_example_crypto_key_iam_binding" {
  crypto_key_id = google_kms_crypto_key.secretmanager_example_crypto_key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"

  members = [
    format("serviceAccount:%s", google_project_service_identity.secretmanager_example_service_account.email),
  ]
}
## -----------------------------------------

## Secret definition
resource "google_secret_manager_secret" "secret" {
  secret_id = "secretmanager_example"
  labels = {
    env = var.env_name
  }
  replication {
    user_managed {
      replicas {
        location = var.google_region
        ## Enables encryption of Secret payloads
        customer_managed_encryption {
            kms_key_name = google_kms_crypto_key.secretmanager_example_crypto_key.id
        }
      }
    }     
  }
  depends_on = [
    google_kms_crypto_key.secretmanager_example_crypto_key,
    google_kms_crypto_key_iam_binding.secretmanager_example_crypto_key_iam_binding
  ]
}

data "google_project" "redis_example_project" {
    provider = google
}

## KMS
## -----------------------------------------------
## Create a KMS key ring to store the key
resource "google_kms_key_ring" "redis_example_key_ring" {
  provider = google
  name     = "redis-example-key-ring"
  ## Should match location of redis instance
  location = var.google_region
}
## Create a crypto key in the generated above key ring
resource "google_kms_crypto_key" "redis_example_crypto_key" {  
  provider = google
  name            = "redis-example-crypto-key"
  key_ring        = google_kms_key_ring.redis_example_key_ring.id
  rotation_period = "100000s"
  lifecycle {
    prevent_destroy = true
  }
}
## Allow cloud-redis SA access to the crypto-key
resource "google_kms_crypto_key_iam_binding" "redis_example_key_iam_binding" {
  provider = google
  crypto_key_id = google_kms_crypto_key.redis_example_crypto_key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  members       = [
     format("serviceAccount:service-%s@cloud-redis.iam.gserviceaccount.com", data.google_project.redis_example_project.number),
  ]
}
## -----------------------------------------------

resource "google_redis_instance" "redis_example" {
  provider       = google-beta.tyk
  name           = "redis-example"
  region         = var.google_region
  tier           = "STANDARD_HA"
  memory_size_gb = 5
  authorized_network = google_compute_network.shared_vpc.id
  connect_mode       = "PRIVATE_SERVICE_ACCESS"
  redis_version      = "REDIS_6_X"
  display_name       = "Redis Example"
  replica_count      = 2
  read_replicas_mode = "READ_REPLICAS_ENABLED"
  auth_enabled   = true
  ## Enables encryption of Data on VM disk
  customer_managed_key = google_kms_crypto_key.redis_example_crypto_key.id
  depends_on     = [
    google_service_networking_connection.private_vpc_connection,
    google_kms_crypto_key.redis_example_crypto_key,
    google_kms_crypto_key_iam_binding.redis_example_key_iam_binding
  ]
}

## KMS: psql instance CMEK - https://cloud.google.com/sql/docs/postgres/configure-cmek
## https://github.com/terraform-google-modules/terraform-docs-samples/blob/main/sql_instance_cmek/main.tf
## -----------------------------------------------
## Create a KMS key ring to store the key
resource "google_kms_key_ring" "psql_key_ring" {
  provider = google
  ## The provided key must be in the same region as the SQL instance.
  location = var.google_region
  name     =  format("psql-%s-%s-apps-key-ring", local.prefix, var.env_name)
}
## Create a crypto key in the generated above key ring
resource "google_kms_crypto_key" "psql_crypto_key" {
  provider        = google
  name            = "psql-crypto-key"
  key_ring        = google_kms_key_ring.psql_key_ring.id
  rotation_period = "100000s"
  lifecycle {
    prevent_destroy = false
  }
}
## Custom SA for psql api:
## https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance#encryption_key_name
resource "google_project_service_identity" "gcp_sa_cloud_sql" {
  provider  = google-beta
  project   = var.google_project_id_apps
  service   = "sqladmin.googleapis.com"
}
## Giving permissions to Service account to use the key
resource "google_kms_crypto_key_iam_binding" "psql_crypto_key_iam_binding" {
  provider      = google-beta
  crypto_key_id = google_kms_crypto_key.psql_crypto_key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  members = [
    format("serviceAccount:%s", google_project_service_identity.gcp_sa_cloud_sql.email),
  ]
}
## -----------------------------------------------

resource "random_pet" "psql" {}

resource "google_sql_database_instance" "psql" {
  provider            = google-beta
  region              = var.google_region
  name                = "postgresql-${random_pet.psql.id}"
  database_version    = "POSTGRES_13"

  ## Enables encryption of Data written to databases
  encryption_key_name = google_kms_crypto_key.psql_crypto_key.id

  settings {
    tier              = local.sql_tier[var.env_name]
    availability_type = "REGIONAL"

    backup_configuration {
      enabled                         = true
      point_in_time_recovery_enabled  = true
      transaction_log_retention_days  = 7

      backup_retention_settings {
        retained_backups = 30
        retention_unit = "COUNT"
      }
    }

    <...>
  }

  depends_on = [
    google_service_networking_connection.private_vpc_connection,
    google_kms_crypto_key.psql_crypto_key,
    google_kms_crypto_key_iam_binding.psql_crypto_key_iam_binding
  ]
}

data "google_project" "gke_project" {
  provider = google
}

## KMS
## + Encrypt Data at rest on node boot disks
## + Encrypt Application-layer secrets
## -----------------------
## Create a KMS key ring to store the key
resource "google_kms_key_ring" "gke_key_ring" {
  provider = google
  ## The key ring must have the same location as the GKE cluster
  location = var.google_region
  name     =  "gke-key-ring"
}

## Create a crypto key in the generated above key ring
resource "google_kms_crypto_key" "gke_crypto_key" {
  provider = google
  name            = "gke-crypto-key"
  key_ring        = google_kms_key_ring.gke_key_ring.id
  rotation_period = "100000s"

  ## GKE VM Disks can be encrypted only by a key that uses symmetric encryption: 
  ## https://cloud.google.com/kubernetes-engine/docs/how-to/using-cmek#create-key
  version_template {
    ## https://cloud.google.com/kms/docs/reference/rest/v1/CryptoKeyVersionAlgorithm
    algorithm         = "GOOGLE_SYMMETRIC_ENCRYPTION"
	## Must be SOFTWARE or HSM
    ## HSM keys enable an additional hardware layer of security but come with a price 10 times higher than Software keys
    protection_level  = "SOFTWARE"
  }
  lifecycle {
    prevent_destroy = true
  }
}

## Grant the compute engine service account permissions to use the key. 
## This is required for nodes' boot disks to access and use the CMEK.
## Nodes in a cluster use the compute engine service account, not GKE service account:
## https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#permissions
resource "google_project_iam_member" "compute-system" {
  provider = google
  project  = data.google_project.cicd_gke_project.name
  role     = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member   = format("serviceAccount:service-%s@compute-system.iam.gserviceaccount.com", data.google_project.gke_project.number)
}

## Grant the GKE service account permissions to use the key. 
## This is required for the cluster to access and use the CMEK
resource "google_project_iam_member" "container-engine" {
  provider = google
  project  = data.google_project.cicd_gke_project.name
  role     = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member   = format("serviceAccount:service-%s@container-engine-robot.iam.gserviceaccount.com", data.google_project.gke_project.number)
}
## -----------------------

resource "google_container_cluster" "app_cluster" {
  provider = google-beta
  name     = "${local.prefix}-${var.env_name}-apps"
  ## Select location according to cluster type (zonal/regional):
  ## https://cloud.google.com/kubernetes-engine/docs/concepts/types-of-clusters#availability
  location = var.google_region

  <...>

  ## This enables application layer encryption on the gke cluster and points to
  ## the key used to encrypt secrets
  database_encryption {
    state     = "ENCRYPTED"
    key_name  = google_kms_crypto_key.cicd_gke_crypto_key.id
  }

  depends_on = [
    google_kms_crypto_key.cicd_gke_crypto_key,
    google_project_iam_member.compute-system,
    google_project_iam_member.container-engine
  ]
}

resource "google_container_node_pool" "node_pool" {
  name_prefix = "pool-2cpu8gb-"
  location    = var.google_region
  cluster     = google_container_cluster.app_cluster.name
  node_count  = 1

  node_config {
    preemptible  = true
    machine_type = "n2-standard-2"
    image_type   = "COS_CONTAINERD"
    workload_metadata_config {
      mode = "GKE_METADATA"
    }
    ## Enables encryption of data at rest on nodes boot-disks
    boot_disk_kms_key = google_kms_crypto_key.gke_crypto_key.id

    <...>
  }

  <...>
}